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As progress on experimental quantum processors continues to advance, the problem of verifying the correct 
operation of such devices is becoming a pressing concern. The recent discovery of protocols for verifying com¬ 
putation performed by entangled but non-communicating quantum processors holds the promise of certifying 
the correctness of arbitrary quantum computations in a fully device-independent manner. Unfortunately, all 
known schemes have prohibitive overhead, with resources scaling as extremely high degree polynomials in the 
number of gates constituting the computation. Here we present a novel approach based on a combination of ver¬ 
ified blind quantum computation and Bell state self-testing. This approach has dramatically reduced overhead, 
with resources scaling as only 0(m * 4 Inm) in the number of gates. 


In recent years, significant progress has been made on the 
development of quantum information processing technolo¬ 
gies. Basic operations with fidelities exceeding those re¬ 
quired for fault-tolerant quantum computation have already 
been demonstrated in both ion-traps mm and superconduct¬ 
ing systems 0. The number of qubits available in a single 
device is also approaching the limit of our ability to fully 
characterize the device, due to the exponential growth in the 
size of the state space. Quantum algorithms running on large 
scale quantum computers hold the promise of dramatic reduc¬ 
tions in run time for certain problems. However, as the size 
of a quantum processor begins to exceed our ability to fully 
characterize it, the question of whether one can trust results 
produced in this manner naturally arises. For certain prob¬ 
lems, such as integer factorization via Shor’s algorithm S). 
the results of the computation can be verified efficiently by a 
classical computer. However, this property does not extend 
to a number of important problems such as the simulation of 
chemistry and other quantum systems 0. 

While there is currently no known way to verify a sin¬ 
gle adversarial quantum processor, two distinct approaches 
have begun to emerge to the problem of verifying quantum 
processors based on interrogation performed during computa¬ 
tion. In the first approach, a quantum processor is repeatedly 
queried by some other smaller quantum device, generally of 
fixed size, which can be characterized by conventional means. 
Aharonov, Ben-Or and Eban introduced an approach to such 
quantum prover interactive proofs based on quantum authen¬ 
tication using a fixed-sized quantum processor for the verifier 
0. An alternative route to verification is based on the univer¬ 
sal blind quantum computation (UBQC) protocol of Broad- 
bent, Fitzsimons and Kashefi 0, which provides an uncondi¬ 
tionally secure 0 protocol for hiding quantum computations 
delegated to a remote server. By constructing the delegated 
computation to include certain traps it is possible to verify 
that the computation has been performed correctly, with ex¬ 
ponentially small probability of error mm. These protocols 
have extremely modest requirements for the verifier, simply 
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the ability to prepare or measure single qubits in a finite set 
of bases. As such, it has proven possible to implement blind 
computation El and verification 02) in a system of four pho¬ 
tonic qubits. 

The second approach to verification is based on the inter¬ 
rogation of two or more entangled but non-communicating 
quantum processors. Reichardt, Unger and Vazirani m 
showed that arbitrary quantum processing could be ver¬ 
ified entirely classically utilizing the statistics of CHSH 
games 01- McKague 00 discovered an alternative ap¬ 
proach using entangled processors based on measurement- 
based computation, through a self-testing protocol for certain 
graph states. 

These two approaches have complimentary strengths and 
weaknesses. The second approach provides a stronger secu¬ 
rity guarantee, since the prohibition on communication be¬ 
tween processors can be enforced through space-like separa¬ 
tion of the devices. This removes the need for the verifier to 
place trust in any pre-existing device, no matter how simple, 
and can be said to be truly device independent: if the tests 
are passed, the verifier can be confident in the result of the 
computation even if quantum devices were constructed by an 
adversary, without need for any characterization. However the 
known protocols are only efficient in the theoretical sense, the 
required resources scale as an extremely high degree polyno¬ 
mial of the circuit dimensions. On the other hand, approaches 
to verification based on blind computation are characterized 
by far better resource scaling, with overhead scaling as low as 
linearly in the circuit size. Here we present a hybrid approach, 
in which self-testing is used to prepare the initial resource for 
verifiable blind computation, and then the computation is im¬ 
plemented using an existing blind computation scheme. The 
resulting protocol is entirely device independent, while requir¬ 
ing resources many orders of magnitude less than existing pro¬ 
tocols. 


Results 

Before explaining our results it would be useful to discuss 
what is meant by verifying a quantum computation. A veri¬ 
fication protocol is such where a single verifier interacts with 
one or more provers. The verifier accepts at the end of the 
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protocol if the output is correct, and should reject otherwise. 
More formally, we say that a protocol with a quantum oper¬ 
ator input U and a classical output to be correct if the output 
is a possible result of measuring the state t/|0) in the Pauli-X 
basis. Following Definition 10 in |9j, given any 0 < (0 < 1, a 
protocol is co-verifiable if for any choice of the prover’s strat¬ 
egy the probability p ermr of the verifier accepting an incorrect 
outcome is bounded by co, p er ror < ft). 

When purely classical output is required, several blind 
quantum computation protocols 00 Ell have the property 
that they can be decomposed into two phases: an initial state 
distribution phase, where direct quantum communication is 
used to prepare a fixed classical-quantum (CQ) correlation be¬ 
tween the verifier’s classical system and the quantum proces¬ 
sor to be tested, followed by an execution phase during which 
purely classical communication is used to implement and ver¬ 
ify the computation. Our approach is to replace the first phase 
of an existing verification protocol, namely Protocol 6 intro¬ 
duced in j9j, with an alternate method of creating the same 
correlation which admits a self-testing strategy. The second 
phase of the protocol remains unaltered, and so security is 
guaranteed if the initial state can be prepared with sufficiently 
high fidelity. 

Protocol 6 of El uses a cylindrical brickwork state as a re¬ 
source. A vertex is randomly chosen to be a trap qubit. The 
rest of the qubits in the row containing this trap and the qubits 
in either the lower or the upper row, depending which is con¬ 
nected to the trap qubit, are prepared in eigenstates of the com¬ 
putational basis. This effectively disentangles the trap qubit 
from the rest of the resource state which now acts as the usual 
brickwork state originally used to achieve UBQC. Because the 
trap qubit is separated from the rest of the state, the client has 
a finite probability of detecting a cheating server. 

Our remote state preparation procedure is inspired by a two- 
device variant of the UBQC protocol 0(17] ljO- Rather than 
directly transmitting a quantum state from the verifier to the 
server, measurements on one half of an entangled pair shared 
between two devices are used to project the remote system 
in a particular basis, thereby generating the desired correla¬ 
tions. We will assume that the verifier’s device consists of a 
simple measurement device capable of measuring individual 
qubits in an arbitrary basis, inspired by the blind computation 
approach taken by Morimae and Fujii ED, where Bob sends 
the resource to Alice one qubit at a time and she performs 
the computation using her device which effectively hides the 
computation from a malicious Bob. We also require that Bob’s 
subsystems are spatially separated such that measurements on 
all of them can be performed in a space-like separated manner, 
and that they be spatially arranged such that this separation is 
apparent to Alice. We will treat the quantum part of the veri¬ 
fier’s device and the quantum processor to be verified as (po¬ 
tentially collaborating but non-communicating) adversaries, 
yielding a situation in which there is a purely classical veri¬ 
fier and N + 1 quantum provers. Alice’s quantum measuring 
device is considered one of the provers while the remaining N 
are in Bob’s possession and each of them sequentially sends 
an EPR pair to be measured by Alice’s device. This sequential 
transmission needs to occur in a sufficiently short time period 


that all meaurements required by the protocol can be made 
while respecting spacelike separation between the measure¬ 
ment events for each proven We shall refer to the verifier as 
Alice and the quantum device to be verified as Bob, with the 
distinction between the quantum and classical systems of Al¬ 
ice clear from context. We retain the terminology of the single 
prover setting, since, due to the asymmetry of the provers, it is 
natural to think of our approach as a blind quantum computing 
protocol in which Alice self-tests her own device. 

At each step of phase one, Alice will receive a qubit from 
Bob. She chooses randomly to either use that qubit for verifi¬ 
cation purposes, or for the purpose of helping remotely create 
the resource state that will be used in phase two. The two pro¬ 
cedures can be intuitively thought of, and are best analysed, as 
two distinct protocols. However it is crucial to keep in mind 
that the two protocols are randomly interwoven and executed 
in the same phase. This ensures that Bob has no knowledge 
about which qubits are used for self-testing and which for re¬ 
mote state preparation. 

The self-testing procedure compares two experiments. The 
reference experiment consists of a multipartite state \y)q on 
Hilbert space Q and local observable Tqj, where j labels the 
subsystem. The physical experiment consists of a multipartite 
state i//) y on Hilbert space S and local observable 7^. In order 
to self-test operations and states with complex coefficients we 
also require Hilbert space R , which is used to determine that 
the devices either both apply the desired operator or they both 
apply its complex conjugate. The physical experiment is said 
to be e-equivalent to the reference experiment if there exists a 
local isometry <f> = O 4 0 <E>#, such that 
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where || • H 2 is the vector distance defined for two vectors | a) 
and | b) as |||a) - \b)\\2 = \/{{a\ - (b|)(|a) - |b)), and Tq. is 
the complex conjugate of Tqj. The state \ junk)s ®Tqj |y/)g 
represents the ideal state up to local isometry. 

At every step of phase one. Bob is asked to prepare a 
Bell pair (|00) + 111)), and send half of it to Alice. She 
will measure the received qubit in a randomly chosen basis 
a g {X a ,Y a ,Z a ,D a ,Ea,F a }' where X A , V A , Z A are Pauli op¬ 
erators, D a = -j^(X A +Z a ), E a = ^(±Xa + Y a ) and F A = 
Ya +Z a ). Here we use Y A = Y and Yg = —Y. After Al¬ 
ice measures all of her qubits, she requests Bob to measure 
all, except m randomly chosen qubits, of his qubits in ran¬ 
dom basis j3 g {Xb,Yb,Zb} and send her the result. Since the 
state that is being verified is symmetric, Alice does not need to 
test Y a X[>,, Z a Xb , or Z A Y/j. Furthermore, measurement settings 
D a Yb , E a Zb, E a Z[ A F a Xb are not necessary in our analysis. 
There are in total 14 measurement settings that are required in 
our self-testing analysis. 

Alice collects all measurement results and at the end of 
phase one she performs a statistical verification, deciding 
whether, with some confidence p, every single one of the 
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FIG. 1. Local isometry <t> used to identify the ideal state in 
Bob’s device. The isometry is a reduced swap gate acting 
individually on Bob’s subsystem and we can think of <t> as 
extracting the desired state using the measured statistics. 


qubits she received were part of a state e-close to a Bell pair. 
If this is the case, she proceeds to phase two. The verifica¬ 
tion protocol used in this phase is based on the approach of 
Mayers and Yao in (201(214 . which was greatly simplified and 
further developed by McKague et al. in (22] [23). This does 
not require a trusted measurement device, and can be tailored 
for any security parameters p and e. 

The graph state generation proceeds similarly to the UBQC 
protocol (7] 0. However, instead of Alice sending a pre¬ 
pared qubit to Bob, Alice measures her half of the Bell pair 
in order to collapse Bob’s half of the pair to one of the valid 
input states. Specifically, the verification protocol for clas¬ 
sical inputs and outputs which we will make use of (Proto¬ 
col 6 of |9l ), requires Alice to prepare and send to Bob, for 
each qubit 1 < j < m needed in the computation stage, a state 
| \jfj) chosen uniformly at random either from the set {10), 11)} 
or the set {l+e,.}}^, where |+ 0 .) = (|0) +e ie J\l)) and 

A = {0,tt/ 4, ... ,7?r/4}. Here, instead of directly preparing 
the state 1 1 //,■), Alice instructs her measurement device to mea¬ 
sure her half of the Bell pair in the basis {|+ 0j .), |— 0 )}, where 
|— 0 .) = |+ 0 .+jr), if she wants to prepare a qubit in the x — y 
plane, and in the computational basis if she wants to prepare 
a dummy qubit. If she measures her half to be in the state 
|+ 0 .), then she knows that Bob’s state is (with high proba¬ 
bility) in the state |+_ 0 ^). Similarly, if she measures | — 0 y -), 
then she knows that Bob’s half is in the state |—- 0 ^). The 
case of measurements in the computational basis is even sim¬ 
pler. If Alice measures |s), where s £ {0,1}, then Bob’s qubit 
will be prepared in the same state. Since Alice does not an¬ 
nounce the angle dj, and since the outcome of her measure¬ 
ment is uniformly random. Bob has no information about the 
input state. The state that they share is given by a CQ correla¬ 
tion 0 , with Alice holding a classical label for Bob’ state, 
given by 5 E s e{0,i} l- s )( iS U ® |s)(s|b f° r dummy qubits and 
g LojSA I e j) (fyU ® l+- 0 /)(+- 0 j I b for qubits used in compu¬ 
tation. Tracing out Alice’s subsystem reveals that Bob’s state 
is maximally mixed. 

Unlike many self-testing schemes, our goal is not to certify 
that Alice and Bob share an EPR pair up to a local isome¬ 
try. Instead we use the measured statistics to certify that for a 
given measurement outcome on Alice’s device. Bob is in pos¬ 
session of a state close to the ideal corresponding state up to 


Protocol 1 Device-Independent Remote State Preparation 
Input: Security parameters p and e, and constant c > 1. 

Steps: 

1. Alice initialises counters k ap = 0 and a correlation estimator 
C a P = 0 for all a and jS. She randomly partitions the N = 
m+ 14cn qubits that she will receive from Bob into m qubits 
to be used for input preparation, and N — m qubits to be used 
for verification from which she will randomly draw h qubits 
per measurement setting. 

2. For 1 < i < N 

(a) Bob is asked to prepare a Bell pair (100) + 111)), and 
sends one half to Alice. 

(b) If the received qubit is for verification, then 

i. Alice randomly chooses an observable a and an 
observable ]3, and increments the counter k aP . 

ii. Alice measures her state according to a, recording 

oc 3 

the outcome £ {—1,1}. 

iii. Alice instructs Bob to measure his qubit according 
to j8. 

iv. Bob measures his half of the prepared Bell pair 

• • • . ocB 

in the instructed basis, and sends his result £ 

{ — 1,1} to Alice. 

v. Alice updates her correlation estimator 

for this particular measurement setting 

C aP = *4r [(^ - !)C a/? + «$ • *$] • 

(c) If the received qubit is for remote state preparation, then 

i. Alice measures her half of the Bell pair in the ba¬ 
sis { 1 + 0 .), | — )}, where Qj is chosen uniformly 
at random from A, if Bob’s corresponding qubit is 
to be used for computation or for trap preparation. 
If his qubit is to be used for dummy qubit prepara¬ 
tion, Alice measures in {|0)(0|, 11) (11}. 

ii. If Alice’s measurement outcome is l+e^}, then 
Bob’s input qubit is |+_ 0 .), whereas if her mea¬ 
surement outcome is | — g ), then Bob’s input qubit 
is | —_0 ). If, instead, Alice measures in the com¬ 
putational basis and the outcome is |s), where 
s £ {0,1}, then Bob’s input qubit is |j). Alice 
stores a classical label for Bob’s state in memory. 

3. If (l — exp (—(n + m)e 2 / 8)) 3 (l — 2exp (— (« + m)£ 2 / 8)) 11 > 
p, and \C a P-p a P\ < £, for all a and j 8 , and p aP is the 
value of ideal correlation for a particular a and ]3, then the 
protocol succeeds, otherwise it aborts. Alice also aborts if 
she does not gather enough statistics about a certain subset 
of correlations. The probability of this occurring decreases 
exponentially with increasing c. 


a local isometry. This is pictured in Fig. [I] for measurements 
with only real coefficients and in Fig.[3]for measurements with 
complex complex coefficients. 

Protocol |T] shows how Alice can remotely prepare sin¬ 
gle qubit states in Bob’s subsystem, up to isometry, with¬ 
out revealing such states to Bob and in a completely device¬ 
independent manner. The following theorem shows the cor- 
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FIG. 2. Isometry <t>' used to obtain information about complex 
operations applied by Bob. 
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rectness of the protocol. That is, unless Alice aborts the pro¬ 
tocol, Bob will be in possession, with probability at least p , of 
qubit states e-close to the ideal state. 

Theorem 1. Let \f/) be the untrusted state shared by Alice 
and Bob. Given a projection IlJ corresponding to the result 
of Alice’s measurement of <J A and that the measured correla¬ 
tions in Protocol^are %-close to the ideal correlations, there 
exists a local isometry <f> that extracts a state close to the de¬ 
sired state on Bob’s side, 


FIG. 3. The total local isometry <F = <t>' o <t> used in the self¬ 
testing analysis of gathered statistics. Alice performs a mea¬ 
surement of the observable a. The isometry <t> extracts the 
corresponding state on Bob’s side as well as the information 
about the complex phase of the applied measurement. 

high probability. This leads to bounds on the action of the 
measured observables. 
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Proof. We start with an outline of the main idea behind the 
proof. By considering the behaviour of the devices as given 
by the gathered statistics, we show that the operators applied 
by the devices on the untrusted state | iff ) must follow commu¬ 
tation and anti-commutation relations close to the ideal Pauli 
operators applied on the ideal shared state \tp '), provided that 
the measured statistics are close to the ideal statistics. Next we 
construct a local isometry <f> = (FoO', composed of a reduced 
swap operation <t> and a phase-kickback operation <F'. The 
local isometry <f> captures the fact that the statistics remain 
unchanged under local change of basis, addition of ancillae, 
change of the action of the observables outside of the support 
of the state, and local embedding of the observables and states 
in a different Hilbert space. Using the correlations shared by 
the untrusted devices, we show that <I> extracts a state close 
to the desired ideal one. The role of the phase-kickback & is 
to distinguish when the operations of the devices are complex 
conjugated. 

The first step uses a result obtained by McKague et al. in 
m which establishes a bound on the maximum distance be¬ 
tween an untrusted shared state and an ideal Bell pair, up 
to local isometry, given statistics for correlations of mea¬ 
surements {X Ai Z a ,Da} on Alice’s subsystem and {X B ,Z B } 
on Bob’s subsystem. By extending this approach to include 
measurements with complex coefficients we obtain the maxi¬ 
mum distance between the state that Alice’s measurement re¬ 
motely prepares on Bob’s subsystem and the ideal input state. 
Assume the real correlations are all at most ^-far from the 
ideal case. This means that the actual correlations satisfy 

(y\X a X b \ y) >1-2, {y\Z a Z b \y) >1-*, \(y\X a Z b \y)\ < 
x, \(y/\D A X B \y) - < 2. \(y\D A Zb\w) - < 2 with 


\\(XaZa+ZaX a )\ ¥ )\\ 2 < 26!, (la) 

\\{X b Z b + Z b Xb)W)\\2 < 2ei — 4£2, (lb) 

\\(Xa-X b )\y )\\2 < £ 2 , (lc) 

\\(Z A -Z B )\Y )\\2 < £ 2 , dd) 


where £1 = (1 + V2)\J (1 +2^2)2 + V^X + 2^22 and e 2 = 
\f2X- Similar inequalities can be derived also for Y A and Y B 
using the corresponding correlations such as (y\Y a Y b \y). 

Bounds in Eq. © and Eq. © can be obtained by us¬ 
ing the definition of the vector norm and using the fact that 
measurements of X A X B and Z A Z B are both nearly correlated. 
Bounds on the anti-commutation of the measurement opera¬ 
tors on the same subsystem in Eq. (lai and Eq. © require 
more work. First, it can be shown from (i//jX/iZ/j|t//) < x 
that X B | \jf) and Z B | i/r) are nearly orthogonal and similarly for 
Alice’s subsytem. This in turn leads to a nearly unitary opera- 
tor 4= (X B +Z B ) which can be used to obtain Eq. ( lbj. Details 
of this derivation can be found in Appendix C in |ZZ’|. 

Now we will discuss how the isometry <t>, presented in 
FIG. [3j extracts the desired state and information about the 
complex phase of the measurements. This approach is based 
on a technique first introduced by McKague and Mosca in 
li23l . Alice’s measurement projects the shared state in register 
5 to v/2II± | \j/) s , where n± = \{1±o S a ) is the correspond¬ 
ing projector. For an outcome a of Alice’s measurement, the 
isometry can be expressed as 
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Ge{0,l} 
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x xl B {l + (-l) k Zs B ) (2) 

x (I+(-lY'o SA )\Y)s\ak) Q \l} RB . 


The action of this isometry is two-fold. The first part of the 
isometry, <F depicted in FIG. [I] swaps the states in registers S B 
and Q b . The second part of the isometry, <t>' shown in FIG. [ 2 ] 
requires a third register on Bob’s side, denoted by R b . The 
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effect of this second part is to extract information about the 
complex phase of the applied measurement. 

The isometry <t>' does not affect the state of the register 
Qb when Alice measures in basis X A or Z A . In particular, 
by substituting these bases into Eq. 0 and considering the 
ideal case when % = 0 in Eq. <[T}, we see that the states 
transform as \/2n| \\ff) s \junk x )OlYYX, nf |0+) e and 

_ hA "A 

v^nf \w)s -» \j Lmk z)s^z QA Yl z QB 10 + )e- where we do not 

care about the state of the register S after the isometry. Us¬ 
ing the fact that Y A anti-commutes with X A and Z A (we are 
still considering the case when % = 0), we can establish that 
Y A —► Yq a M$ a , where M$ A is a unitary and similarly for Y B . 
This means that in the ideal case, for any measurement that 
Alice performs, we have 

i>(V2n±jvA) s ) 

= \ (i+M B )\j un k a } s -^n± Q n± QB \4> + ) Q \o) RB ( 3 ) 

+(i-M B )\junk a )s-J=n± QA (n± e J |</> + ) e |i)ff s , 

where p a = (0 + |IT^ |0 + ). This shows that the register 

Q b contains the ideal desired state corresponding to Alice’s 
measurement and the complex phase of the measurement is 
controlled on the state of register R B . 

Finally, we can consider the case when % ^ 0. By com¬ 
paring Eq. ([2} with Eq. (|3|. along with the bounds in Eq. 0 
and repeated application of triangle inequality as in Appendix 
A of l22l . we obtain that the distance between the real state 
and the ideal state, up to some local isometry, is at most 
e = j(9£i+£ 2 ). □ 

What remains to be shown is the scaling of Alice’s confi¬ 
dence about Bob’s state given the gathered statistics from self¬ 
testing. We forgo the use of a Chernoff bound as this would 
require the assumption of independent behaviour and would 
compromise device-independence. Rather we adopt a simi¬ 
lar approach to Pironio et al. 8241 . The measurement process 
forms a martingale with bounded increment which allows the 
application of Azuma-Hoeffding inequality ||25l[26l . 

Denote the set of all EPR pairs that Alice and Bob share by 
XT with cardinality X/ 1 =N. This set can be partitioned into 
the subset of pairs used in self-testing that are measured by 
both Alice and Bob, XT tf . st C XT with latest| = n, and the set 
of pairs used for remote state preparation where only Alice 
measures her subsystems, =5^ pre p C XT with ,5^ pre p = m. We 
also have N = n + m. 

Consider an arbitrary subset XT C X/ that is again parti¬ 
tioned as above, XT’ = XX[ est U T prep with corresponding car¬ 
dinalities \XT\ = n + m. We can further partition the subset 
of pairs used in self-testing according to the basis that the 
qubits are measured in, detest = with n = I a j8 n a P, 

where XT le f is the subset of pairs where Alice measures in a 
basis and Bob measures in /I basis. Similarly we can parti¬ 
tion ^ prep = G a p,T pr i p with m = Y*a,p m a P. This may look 


strange at first since we have stated that XT piep is the subset of 
EPR pairs that get measured only on Alice’s side. However, 
in the upcoming theorem, it is useful to consider hypothetical 
measurements in basis (3 by Bob. 

The average ideal correlation over the subset S can be writ¬ 
ten as 

a = ^L(«“ / 3 +'»“ / 3 )a“ /3 , 

\’ y I a,p 

where p. a P = (<j) + \a (g> f3\ (j) + ) is the ideal correlation for a pair 
measured in a by Alice and p by Bob. Denoting the classical 
outcome of Alice’s and Bob’s measurement on the I th pair by 
at £ {—1,1} and b, £ {—1,1}, respectively, we can define a 
random variable C, = cijbi. The average measured correlation 
over the subset XT is then 


\J?\ Y^‘ \y\ I ^i+ Y 

1 1 iey I iey , est 1 1 iey mtv 


K a,p 

+ —L- Y (£ a/3 ± 

l-^l a,p V 


(4) 


where e a P represents the measured deviation from ideal cor¬ 
relation for measurement a{3. For simplicity we set e a P = £ 
for all cc,f3. £ ,a ^ is the hypothetical deviation from ideal cor¬ 
relation obtained if Bob measured his qubits of XT prep as well. 
Since these qubits are in reality not measured we assume the 
worst case scenario. 
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Again to simplify the notation we assume the most pessimistic 
scenario and set \e' a P\ = 2 for all a,/3. The real correla¬ 
tion that the devices share is denoted by C, (W A ) = Pr (a, = 
bi | W A ) — Pr(a,- bj\W A ), where W A denotes the history of Al¬ 
ice’s instructions and measurements. The following theorem 
bounds the probability that the real average correlation devi¬ 
ates from the average ideal correlation by a large amount given 
the statistics from Alice’s and Bob’s measurements. 


Theorem 2. Given an arbitrary subset of EPR pairs, 50 C 
XT , and that the measured average correlation is jx ± £, the 
probability that the real average correlation over this subset 
is close to the ideal average correlation is given by 


Pr 


1 


YCi(W A )-p 

iey 


< 


2h£ + m(2 + £) 


h +m 


> 1-2 8 , 


( 6 ) 

where 8 = exp(— (h +m)e 2 /S). 

Proof. We first look at the case when the measured average 
correlation is ft+ £. Define a new random variable. 


k 

i* = £[c,(w A )-q], 


/=! 
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where k € {0,1,..., \^\}. The expected value of \Y n \ is fi¬ 
nite and the conditional expected value is EiY^pW/C) = 7^. 
Also the random variable has a bounded increment, q = 
\Yk + \ — < 2 for all k. Therefore the random variable 7& 

is a martingale with bounded increment an so we can apply 
the Azuma-Hoeffding inequality 



Choosing y = |S|e, Eq. (j7|i can rewritten as 


(7) 


Pr 



L<m)- Y. q 

Aey iey . 



< exp 



Splitting the expression for the measured average correlation 
as in Eq. (JiJ and assuming the worst case scenario, £ m P = 2, 
we get 


< exp("-i|^|e 2 


( 8 ) 


Defining the martingale as 7^ = Yli=i [Q — Ci(W A )] , and fol¬ 
lowing the same steps as above we arrive at a new bound. 


Pr {ihL c,iWA} ^- t) £ exp B |JV )' 

(9) 

Combining Eq. ([8]) with Eq. (|9|, the probability that the av¬ 
erage real correlation is close to the average ideal correlation 
is 


Pr A{2 - £) <Xy dm -n < 2ne+ " (2 +£) 

v i^i ~\y\h m 


> 1—2exp (~\y\£ 


iey 

2 


( 10 ) 


The lower endpoint of the interval in Eq. ( fT0| > can be extended 
while keeping the same lower bound on the probability. 


Pr 


Bl 


YC,(W A )-{1 


iey 


< 


2ne + m(2 + e) 

Bl 


> 1 —2exp ( —-|o5^|e* 


If we are interested in a particular correlation a ft, as in The¬ 
orem |T] we can obtain the appropriate bound and probability 
by setting ■'/' to include all the pairs that are measured in the 
basis ap and no other pairs where both Alice and Bob mea¬ 
sure. Also we set y = 2n£ + m ( 2+t 1 j n this case. It can be seen 

^ n+m 

that this is sufficient to imply Theorem [1] by considering an 
initial set of n + m pairs, used to test a single correlation and 
then randomly inserting an additional n qubits of each addi¬ 
tional correlation to be tested. The tests are then always such 
that they can be considered to have been performed on sub¬ 
sets of cardinality n + m, where the location of the m untested 
qubits remains random. 

Theorem[I|bounds the maximum distance between the ideal 
state, shared between Alice and Bob, which we denote \yf B ), 
and the actual state \<j>j) that they share, up to local isometry 
on Bob’s side (since the classical labels are stored in Alice’s 
classical memory rather than her quantum device). It is impor¬ 
tant to keep in mind that | yf B ) represents the ideal two-qubit 
state up to local isometry <t>. In other words, |i f/^ B ) is not it¬ 
self in general a two-qubit state, just as performing a partial 
trace of it over Alice’s subsystem does not in general result in 
a single-qubit state on Bob’s subsystem. For any fixed value 
of Alice’s classical register the reduced state on Bob’s side is 
pure, denoted by tyf), provided he follows the protocol hon¬ 
estly. Expressing the distance between this ideal state and the 
state obtained from a run of the protocol, in which Bob is not 
constrained to be honest, in terms of the vector distance makes 
it straightforward to obtain a lower bound on the fidelity of 
Bob’s input state. Infidelity, introduced into the input state by 
Bob’s dishonest behaviour, leads to an additive error in the 
probability of the verification protocols of f9j accepting an in¬ 
correct outcome. 

Each of the verification protocols considered in J9) can be 
viewed as a quantum channel J 2 > (p) which acts on a fixed CQ 
correlated state. The probability of accepting a state orthogo¬ 
nal to the output in the case of an honest run is then given by 
the expectation value of the projector P± onto the orthogonal 
but accepted subspace. The initial state of Bob’s subsystem 
is p B = pp B g + (1 — p)p B g. where p = (1 — <5) 3 (1 — 25) 11 
is the probability of preparing a state p B e which is the result 
from Alice’s measurement on her subsystem, where the bipar¬ 
tite system \&j B ) was e-close in vector distance to the ideal 
state | y/f B ) for all j £ { 1 ,... pii}. p B g is defined in a similar 
fashion. The probability of accepting an incorrect outcome is 
given by 


terror = Tr (P ± ^(p B )) . 


Using m < m, we can extend the interval further 


Pr 


1 

W\ 


YQ(w A )-p 

iey 


< 


2ne + m(2 + e) 
h + m 


>1-25, 


where 8 = exp (—(« + m)e 2 /8). Identical expression is ob¬ 
tained for the case when the average measured correlation is 
p~E. 

□ 


Substituting in the expression for p B , p e rror becomes a sum 
of three terms. The first term, pTr(p > x^'(IV /B )(V /S |))> 
represents the probability that Alice accepts the incor¬ 
rect output given the correct input. The second term, 
pTr — \ W B )(W B \))’ provides a correction to the 

first term for a state e-close to the correct input. Lastly, 
(1 — p)Tr (f’x^ z (p>g)) is the probability of accepting the 
wrong output given an input state that is more than e-far from 
the correct input. Evaluating these expressions gives the final 
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Protocol 2 Device-Independent Blind Quantum Computation 
Input: On Alice’s side: 

1. Security parameters p, £ and A. 

2. A quantum computation expressed as a measurement 
based computation on a cylindrical brickwork state of 
m qubits, with measurement angles 0 = (0j)l<i<m with 
(pi £ A, incorporating a set of trap qubits T and dummy 
qubits D chosen as described in the main text and illus¬ 
trated in Figure [4] 

3. m random variables 0/ with values taken uniformly at 
random from A. 

4. A fixed function Cq that for each non-output qubit i 
computes the angle of the measurement to be sent to 
Bob. This function depends on <j)i,6i,rj,Xj and the re¬ 
sult of the measurements that have been performed so 
far, s<i (the definition of the function Cq is identical 
to the one found in (5J, and its full description can be 
found there). 

Steps: 

1. Alice and Bob engage in Protocol[T] 

2. Bob takes his m states prepared in the previous step and en¬ 
tangles them according to the cylindrical brickwork graph. 

3. Alice sets all the values in s to be 0. 

4. For i: 1 < i < m 

(a) Alice computes the angle <5; = Co(/, </)/, 0/,/•/,.r,-,s) and 
sends it to Bob. 

(b) Bob measures qubit i with angle 8, and sends Alice the 
result bj. 

(c) Alice sets the value of Sj in s to be i>; © r 

5. Alice accepts if b, = r t , for all traps tef. 


bound on the probability of accepting an incorrect output, 

Perror < P (1 - A)+p||p|g - |v/ B )(v/ B |||tr + (1 - p), 

where 1 — A is the maximum probability of accepting an in¬ 
correct outcome using the ideal initial state | y/ B ) and a multi¬ 
trap variant of the verification scheme in Protocol 6 in J9). 

This concludes phase one of our protocol which tests the 
operation of Alice’s device and produces a separable input 
state on Bob’s quantum computer with high probability. Al¬ 
ice then proceeds with the computation by instructing Bob to 
entangle the prepared qubits into a graph state, and use that 
graph state to perform verifiable blind computation. The pro¬ 
tocol they follow is given in Protocol [2j which is based on 
Protocol 6 in |9). We have modified the protocol found there 
to have classical input and output only, and in order to make 
it device-independent. Correctness follows directly from the 
correctness of the unmodified protocol. 

Protocol 6 of a uses a single qubit to detect Bob’s devi¬ 
ation from Alice’s instructions making the protocol (l — A). 
verifiable. Alice randomly chooses a trap position t on a cylin¬ 
drical brickwork state and prepares the rest of the qubits in 
the same and neigbouring row in computational basis turn¬ 


ing them into dummy qubits. Instructing Bob to apply entan¬ 
gling operations according to the cylindrical brickwork graph 
blindly produces a rectangular brickwork state in a tensor 
product with a single trap that Alice uses for verification. 

We modify this scheme to incorporate multiple trap qubits 
and obtain a protocol that is (1 — A)-verifiable, where 0 < A < 
1 is a constant. Alice starts with a cylindrical brickwork state 
and chooses a set of trap qubits T, by randomly choosing a set 
R of consecutive rows and fixes a 2-colouring on the graph, 
taking all qubits in R of colour C are taken to be traps, as 
illustrated in Fig. [4] She prepares the remaining qubits located 
in the same rows as the trap qubits in the computational basis. 
Additionally Alice also prepares the qubits in rows located 
directly above and below R in the computational basis. We 
refer to the set of qubits containing the trap qubits and the 
dummy qubits prepared in the computational basis as a tape. 
Alice then instructs Bob to entangle the qubits according to 
the cylindrical brickwork graph which produces the brickwork 
state in a tensor product with \T\ trap qubits. 

In order to achieve (1 — A)-verifiability for constant A < ^, 
we require that the width of the tape scales in such a way that 
|/?| is a constant fraction 2A of the total number of rows of 
the cylindrical brickwork state. The proof that this leads to 
a constant probability of accepting an incorrect outcome of 
the computation follows precisely the same steps as the proof 
of Theorem 8 in m which proves (l — A)-verifiability of a 
single-trap protocol, where the increased verifiability stems 
directly from the increased probability that any given qubit is 
a trap qubit. Correctness also follows directly from the cor¬ 
rectness of Protocol 6 in 0 . Combining the multi-trap ver¬ 
ification on cylindrical brickwork state with the self-testing 
procedure leads to the following corollary. 

Corollary 1. Protocol's (1 — pA + 2p\fm£)-verifiable, that 
is the probability that an incorrect outcome is accepted at the 
end of the verification procedure is 

Perror < 1 - pA + 2py/m£, 

where p> (1 — (5) 3m (l — 28) llm is Alice’s confidence that Bob 
is in possession of an m-qubit input state close to the ideal 
one, 8 = exp (—|e 2 (« + m)), and h + m = 0(m 4 In m) is the 
number of Bell pairs needed for self-testing per measurement 
setting. 

Proof. Expanding the expression for the bound on the vec¬ 
tor distance between the shared state and the ideal state 
up to isometry \\\yf B ) — \<j>f B )\\2 < £, for all j, we get 
Re(y/y B | 0^ B ) > 1 — ^e 2 , which can be used to obtain a lower 
bound on the fidelity between the states, 

F {\Vj B )Mf B ))> ( 1_ ^ g2 ) ’ 

where we used F(\\j/f B ),> 
Re 2 (i//A B | 0 A B ). The fidelity is non-decreasing under partial 
trace which leads immediately to F(\\p B ),p B ) > (1 — j£ 2 ) 2 . 
Fidelity is also multiplicative under tensor products which 
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FIG. 4. Multi-trap verification on a cylindrical brickwork 
state: 1. Alice randomly selects a set of consecutive rows 
R and assigns trap qubits to every qubit in R corresponding 
to a random vertex colour in a two colouring of the graph. 2 . 
The remaining qubits in the selected tape are dummy qubits 
and prepared in the computational basis. 3. Bob’s entangling 
operation according to the cylindrical brickwork graph does 
not entangle the trap qubits to the rest of the brickwork state. 
4. Discarding the dummy qubits, we finally obtain a tensor 
product of the brickwork state and the trap qubits. 


leads to the following bound on the fidelity of the whole 
/w-qubit input state 


F(W B ),P B P< ~ e ) = X\f{W b ),p b ), 

7=1 



> 1 —me 2 , 


where we take e to be the common upper bound on for all j. 
Using the relationship between trace distance and fidelity, 

^l|P<e - I'/X'/llltr < ^\-F(\\i> B ),p%), 

it follows that 

llp|gHv^)(V^llltr<2\/^e. 

Therefore the total probability of Alice accepting an incorrect 
outcome is bounded by 

Perror < P(1 — A) + p ||p<£ — | )(V / l|| tr + (l~P) 

< 1 — pA + 2p\fmk. (11) 

Expanding the expression for Alice’s confidence p and de¬ 
manding that the confidence be close to unity, we obtain 
n + m = 0(e“ 2 ln m). We would like to now find a scaling re¬ 
lationship between e and the input size m. Requiring that the 
last term in Eq. scale as a constant bounded from above 
by pA leads to e = 0(m l,/2 ). Using Theorem[l]we know that 
e = 0(s 1 / 4 ) which means that £ = 0(m~ 2 ). This finally leads 
to n+m = 0(m 4 lnm) which is the combined number of input 
qubits and the number of Bell pairs needed per measurement 
setting in the verification of remote state preparation. □ 


Conclusion 

Our scheme offers a large improvement over current 
schemes mm that achieve a similar function. Splitting 
the computation into two parts, namely device-independent 
remote state preparation followed by authenticated computa¬ 
tion, presents a distinct advantage. At all stages of phase one 
we only need to self-test individual EPR pairs, unlike the ap¬ 
proach in ED that self-tests the entire graph state. This re¬ 
sults in the number of repetitions of their protocol to be N > 
3 16 • 10 38 - 7 -/ 7 22 , where n is the number of vertices of the graph. 
It is worth noting that the client in 031 is completely classi¬ 
cal and the protocol requires n non-communicating servers, 
each holding one vertex of the graph state. The protocol of 
Reichardt et al. D3 also considers a fully classical client and 
a constant number of non-communicating quantum servers. 
The client relies on CHSH games to test the shared states as 
well as the operation of the servers. To authenticate the whole 
computation, the client uses the servers to implement state and 
process tomography. This introduces a large overhead, where 
the leading term is of the order at least « 8192 , where n counts 
the number of gates needed to implement the computation. 
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We note that in recent and independent work from the re¬ 
sults reported here, Gheorghiu, Kashefi and Wallden have also 
considered splitting the verification problem into a remote 
state preparation followed by authenticated blind computa¬ 
tion Gzl. A major difference between their results and ours, 
is that their protocol utilizes the CHSH rigidity approach of 
ED, rather than Bell pair self-testing, resulting in overhead 
which scales as n c for a constant c > 2048. 

In contrast to these other methods, the protocol de¬ 
scribed here requires an overhead in resources that scales as 
0(m 4 In in) where m is the number of vertices used in the com¬ 
putation. While this represents a drastic increase in efficiency 


over other existing schemes, further reducing overhead re¬ 
mains an important open question. 
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